# RedAction 1.0.21.0 dependency and licence manifest

Audit date: 23 July 2026  
Build platform: Windows 11 x64  
Python: 3.14.3 x64

`Bundled` means code or data was found in the PyInstaller `dist/REDACT` output.
Licence expressions are taken from installed package metadata or the identified
upstream project. `Review` means the repository does not establish enough facts
to make a final licensing conclusion.

| Component | Version | Licence / status | Bundled | Licence text | Source access |
|---|---:|---|---|---|---|
| RedAction application | 1.0.21.0 | GNU AGPL-3.0-only | Yes | `LICENSE`, `COPYING` | Version-specific corresponding source is published; signed Store commerce testing remains outstanding |
| Python | 3.14.3 | PSF-2.0 | Yes | Included | https://www.python.org/downloads/source/ |
| PyMuPDF | 1.27.2.3 | AGPL-3.0 or Artifex commercial; this release selects AGPL | Yes | Included | `third_party_sources/1.0.16.0/pymupdf-1.27.2.3.tar.gz` |
| MuPDF | 1.27.2 | AGPL-3.0 or Artifex commercial; this release selects AGPL | Yes, through PyMuPDF | Included | `third_party_sources/1.0.16.0/mupdf-1.27.2-source.tar.gz` |
| PySide6 / Addons / Essentials | 6.11.1 | LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only | Yes | Included | `third_party_sources/1.0.16.0/pyside-setup-everywhere-src-6.11.1.tar.xz` |
| shiboken6 | 6.11.1 | LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only | Yes | Included | Same PySide source archive |
| qasync | 0.28.0 | BSD-2-Clause | Yes | Collected from package | https://github.com/CabbageDevelopment/qasync/tree/v0.28.0 |
| Qt Core/Gui/Widgets/Network/OpenGL | 6.11.1 | LGPL-3.0/GPL options; module/source-file terms apply | Yes, dynamically linked | GPL/LGPL included | `third_party_sources/1.0.16.0/qtbase-everywhere-src-6.11.1.tar.xz` |
| Qt SVG | 6.11.1 | LGPL-3.0/GPL options; module/source-file terms apply | Yes, dynamically linked | GPL/LGPL included | `third_party_sources/1.0.16.0/qtsvg-everywhere-src-6.11.1.tar.xz` |
| Qt Image Formats plugins | 6.11.1 | LGPL-3.0/GPL options plus format-library notices | Yes, dynamically loaded | Included in source archive | `third_party_sources/1.0.16.0/qtimageformats-everywhere-src-6.11.1.tar.xz` |
| Qt PDF/PDF Widgets and PDFium snapshot | 6.11.1 | Qt PDF LGPL-3.0 or GPL-2.0 route; PDFium/Chromium-derived permissive notices apply | Yes, dynamically linked | Included in exact source archive | `third_party_sources/1.0.16.0/qtwebengine-everywhere-src-6.11.1.tar.xz` |
| Qt QML/Quick/Virtual Keyboard | 6.11.1 | Not applicable to revised payload | No; excluded and filtered before COLLECT | Not shipped | See `QT_COMPONENTS.md` |
| Pillow | 12.2.0 | MIT-CMU | Yes | Collected from package | https://github.com/python-pillow/Pillow |
| RedAction custom OpenCV | 4.13.0 / wrapper 92 (`4.13.0.92+redaction1`) | Apache-2.0; retained codec-library notices apply | Yes; source-built modules only. IPP, ITT, FFmpeg, video, videoio and HighGUI are disabled | Included; see `OPENCV_BUILD.md` | `third_party_sources/1.0.18.0/opencv-4.13.0.zip` and `opencv-python-92.zip` |
| OpenCV frontal-face cascade | OpenCV 4.13 package copy | Intel Open Source Computer Vision Library licence in XML header | Yes | Included with XML | `third_party_sources/1.0.16.0/haarcascade_frontalface_default.xml` |
| NumPy | 2.4.4 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | Yes | Collected from package | https://github.com/numpy/numpy |
| python-docx | 1.2.0 | MIT | Yes | Collected from package | https://github.com/python-openxml/python-docx |
| python-pptx | 1.0.2 | MIT | Yes | Collected from package | https://github.com/scanny/python-pptx |
| XlsxWriter | 3.2.9 | BSD-2-Clause | Yes | Collected from package | https://github.com/jmcnamara/XlsxWriter |
| openpyxl | 3.1.5 | MIT | Yes | Collected from package | https://foss.heptapod.net/openpyxl/openpyxl |
| lxml | 6.1.0 | BSD-3-Clause plus libxml2/libxslt notices | Yes | Collected from package | https://github.com/lxml/lxml |
| et_xmlfile | 2.0.0 | MIT | Yes | Collected from package | https://foss.heptapod.net/openpyxl/et_xmlfile |
| cffi | 2.0.0 | MIT | Yes | Collected from package | https://github.com/python-cffi/cffi |
| pycparser | 3.0 | BSD-3-Clause | Yes | Collected from package | https://github.com/eliben/pycparser |
| argon2-cffi | 25.1.0 | MIT | Yes | Collected from package | https://github.com/hynek/argon2-cffi |
| argon2-cffi-bindings | 25.1.0 | MIT; bundled Argon2 C code has its own notice | Yes | Collected from package | https://github.com/hynek/argon2-cffi-bindings |
| typing_extensions | 4.15.0 | PSF-2.0 | Yes | Collected from package | https://github.com/python/typing_extensions |
| winrt-runtime and required winrt packages | 3.2.1 | MIT | Yes | Exact upstream licence retained; wheels declare `License-Expression: MIT` | `third_party_sources/1.0.16.0/winrt/` |
| PyInstaller bootloader | 6.20.0 | GPL-2.0-or-later with bootloader exception | Yes | Collected from package | https://github.com/pyinstaller/pyinstaller |
| PyInstaller hooks | 2026.5 | GPL-2.0-or-later | Build only | Collected from package | https://github.com/pyinstaller/pyinstaller-hooks-contrib |
| pip | 25.3 | MIT | Build only | Collected from package | https://github.com/pypa/pip/tree/25.3 |
| setuptools | 82.0.1 | MIT | Build only | Collected from package | https://github.com/pypa/setuptools/tree/v82.0.1 |
| wheel | 0.46.3 | MIT | Build only | Collected from package | https://github.com/pypa/wheel/tree/0.46.3 |
| pytest | 9.0.2 | MIT | Test only | Collected from package | https://github.com/pytest-dev/pytest/tree/9.0.2 |
| altgraph | 0.17.5 | MIT | Build only | Collected from package | https://github.com/ronaldoussoren/altgraph |
| packaging | 26.0 | Apache-2.0 OR BSD-2-Clause | Build/test | Collected from package | https://github.com/pypa/packaging/tree/26.0 |
| pefile | 2024.8.26 | MIT | Build only | Collected from package | https://github.com/erocarrera/pefile |
| pywin32-ctypes | 0.2.3 | BSD-3-Clause | Build only | Collected from package | https://github.com/enthought/pywin32-ctypes |
| FastAPI / Starlette | 0.139.0 / 1.3.1 | MIT / BSD-3-Clause | Test only; excluded from MSIX | Collected from package | https://github.com/fastapi/fastapi |
| Pydantic / pydantic-core | 2.13.4 / 2.46.4 | MIT | Test only; excluded from MSIX | Collected from package | https://github.com/pydantic/pydantic |
| annotated-doc / annotated-types | 0.0.4 / 0.7.0 | MIT | Test only; excluded from MSIX | Collected from package | Package source URLs recorded in SBOM |
| anyio / idna / typing-inspection | 4.14.1 / 3.18 / 0.4.2 | MIT / BSD-3-Clause / MIT | Test only; excluded from MSIX | Collected from package | Package source URLs recorded in SBOM |
| OpenSSL runtime libraries | 3.x files supplied with Python runtime | Apache-2.0 | Yes (`libcrypto-3.dll`, `libssl-3.dll`) | Python/upstream notices must be retained | https://github.com/openssl/openssl |
| libffi runtime | 8.x file supplied with Python/cffi runtime | MIT | Yes (`libffi-8.dll`) | Upstream notice required | https://github.com/libffi/libffi |
| Microsoft Visual C++/UCRT runtime | Build/runtime supplied DLLs | Microsoft redistributable terms; not AGPL | Yes | Review distribution terms | Microsoft Visual C++ Redistributable documentation |

## System and non-bundled components

| Component | Status |
|---|---|
| Windows.Media.Ocr language models | Windows system API; no OCR model is distributed in the MSIX. |
| Tesseract | Not bundled and excluded from the PyInstaller build. `tesseract_env.py` is legacy source only. |
| spaCy and NLP models | Not bundled; the desktop application uses its built-in local detector. |
| Fonts | No independent font files were identified in the application source or MSIX. Segoe UI is requested as a Windows system font. PDF libraries may use their own documented base fonts. |
| Microsoft Store API | Windows system API; Store transactions and entitlements are handled by Microsoft. |

## Assets and templates requiring attention

- Office templates included by python-docx/python-pptx/openpyxl are treated as
  package material under their upstream licences. The MSIX builder removes OPC
  filenames that are illegal inside an MSIX but retains packed templates used at
  runtime.
- The OpenCV face cascade is copied into the release source with its embedded
  Intel licence notice.
- Asset provenance is tracked in `ASSET_LEDGER.csv` and `ASSET_LEDGER.md`.
  The current ledger has no `REQUIRES_REVIEW` entries.
- Exact PySide6/Qt 6.11.1 source archives for every retained module, including
  Qt PDF/PDFium, are retained locally. See `QT_COMPONENTS.md`.
- Native libraries can contain further embedded third-party code. The collected
  package licence files and generated CycloneDX/native inventory are included;
  specialist review remains advisable for the final release.

Unknown or ambiguous items above are deliberately flagged rather than assigned
an assumed licence conclusion.